fix: chown var/t1 and var/t3 to simulator uid 10001 for k3d

Non-root drone pods need write access on the hostPath lake. Ansible now creates var/t1 and var/t3 owned by uid 10001 instead of relying on 0777 alone after legacy root-owned parquet trees.
fix: run simulator image as non-root user (Trivy DS-0002)
2026-07-08 20:27:25 +01:00 · 2026-07-08 20:20:19 +01:00
2 changed files with 13 additions and 0 deletions
@@ -29,12 +29,16 @@
        path: "{{ data_dir }}"
        state: directory
        mode: "0777"
+        owner: "10001"
+        group: "10001"

    - name: Create warehouse directory (T3 host path inside the k3d node)
      ansible.builtin.file:
        path: "{{ warehouse_dir }}"
        state: directory
        mode: "0777"
+        owner: "10001"
+        group: "10001"

    - name: List existing clusters
      ansible.builtin.command: k3d cluster list -o json
@@ -7,6 +7,10 @@ COPY virtual_drone ./virtual_drone
 COPY monitoring ./monitoring
 COPY explorer ./explorer
 COPY tests ./tests
+RUN groupadd --gid 10001 swarm \
+    && useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \
+    && chown -R swarm:swarm /app
+USER swarm
 RUN pytest tests/ -q

 FROM python:3.12-slim
@@ -19,6 +23,11 @@ COPY virtual_drone ./virtual_drone
 # them without bind mounts (Compose overrides these with live mounts)
 COPY monitoring ./monitoring
 COPY explorer ./explorer
+RUN groupadd --gid 10001 swarm \
+    && useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \
+    && mkdir -p /data \
+    && chown -R swarm:swarm /app /data

 ENV DATA_DIR=/data
+USER swarm
 CMD ["python", "-m", "virtual_drone.main"]
Author	SHA1	Message	Date
eSlider	9f99d132e3	fix: chown var/t1 and var/t3 to simulator uid 10001 for k3d CI & Release / Verify simulator (push) Successful in 12s Details CI & Release / Trivy scan (push) Successful in 9s Details CI & Release / Semantic Release (push) Successful in 4s Details Non-root drone pods need write access on the hostPath lake. Ansible now creates var/t1 and var/t3 owned by uid 10001 instead of relying on 0777 alone after legacy root-owned parquet trees.	2026-07-08 20:27:25 +01:00
eSlider	669e8ff005	fix: run simulator image as non-root user (Trivy DS-0002) CI & Release / Verify simulator (push) Successful in 11s Details CI & Release / Trivy scan (push) Successful in 9s Details CI & Release / Semantic Release (push) Successful in 4s Details Add swarm uid 10001 in both build stages so Trivy config scan passes and containers do not run as root. Mounted /data volumes should be world-writable or owned by uid 10001 (var/t1 from Ansible is 0777).	2026-07-08 20:20:19 +01:00